Cybersecurity Analyst - AI & Firewalls

About the role

Global Power Components (www.globalpowercomponents.com) is seeking a hands-on Cybersecurity Analyst for a direct-hire position based in Milwaukee, WI (onsite 5 days/week). The primary focus is AI and firewall security: securing and governing the AI tools the business adopts — including Microsoft 365 Copilot, AI agents, and third‑party generative AI services — while owning day‑to‑day administration of the Ubiquiti UniFi firewall and network security controls across all sites. The role emphasizes securing AI rather than building it, though hands‑on experience implementing AI solutions is required to understand deployment and risk. You will also support security operations, incident response, and governance, working closely with IT, engineering, and operations to keep a modern manufacturing environment secure, resilient, and productive.

Responsibilities

AI Security & Governance (~40%)

• Review proposed AI tools, agents, and use cases for security, privacy, and data‑protection risk; define the security requirements they must meet; and verify those controls are in place before go‑live.
• Help develop and enforce GPC’s AI acceptable‑use policy and standards, and maintain an inventory of approved AI tools, agents, and integrations.
• Secure Microsoft 365 Copilot and other AI assistants by reviewing data permissions and oversharing and applying sensitivity labels, data loss prevention (DLP), and audit controls (e.g., Microsoft Purview), so AI tools surface only data users are authorized to see, and engineering drawings, designs, and customer information stay protected.
• Detect and manage unsanctioned “shadow AI” use through firewall application control and content filtering, cloud app discovery (e.g., Microsoft Defender for Cloud Apps), and endpoint and browser policies.
• Assess AI agents, plugins, connectors, API integrations (e.g., Microsoft Foundry / Azure OpenAI), and Model Context Protocol (MCP) servers for excessive permissions, credential and secrets exposure, logging gaps, and supply‑chain risk, and enforce least privilege for agent identities.
• Threat‑model and test AI‑enabled applications against the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, and MITRE ATLAS including prompt injection, sensitive information disclosure, data poisoning, and excessive agency.
• Evaluate AI vendors’ data handling, retention, use of customer data for model training, and security controls as part of third‑party risk reviews.
• Monitor AI usage and AI‑related security events and investigate misuse or data exposure.
• Create user guidance and training on safe AI use, including how to recognize AI‑generated phishing and deepfake voice or video impersonation.

Firewall & Network Security (~35%)

• Administer, configure, and maintain GPC’s Ubiquiti UniFi firewall platform, including zone‑based firewall policies, application‑aware (Layer 7) rules, NAT, intrusion detection and prevention (IDS/IPS), content and URL filtering, SSL/TLS inspection, region and domain blocking, and threat‑signature subscriptions (e.g., UniFi CyberSecure).
• Design and enforce least‑privilege segmentation between GPC’s separate network environments including corporate, guest, production/shop‑floor (OT), and IoT across multiple sites and buildings, using VLANs, firewall zones, and identity‑aware policies (e.g., Microsoft Entra integration).
• Configure and secure site‑to‑site connectivity (IPsec VPN, Site Magic SD‑WAN) and remote access (e.g., WireGuard, Teleport), including hybrid connectivity to Microsoft Azure.
• Maintain firewall high availability and resilience (e.g., Shadow Mode failover, multi‑WAN), firmware and UniFi OS updates, and configuration backups through UniFi Site Manager.
• Own firewall change management: evaluate rule and exception requests for business justification, implement approved changes, and keep rule and exception documentation current.
• Conduct scheduled firewall rule‑base reviews to remove unused, shadowed, or overly permissive rules.
• Forward firewall, IDS/IPS, and network logs to the SIEM, and investigate anomalous traffic and threat alerts.
• Manage host‑based firewall policies for servers and workstations (e.g., Windows Firewall through Microsoft Intune) to complement network controls.
• Support network security projects — such as new buildings, gateway deployments and upgrades, and network redesigns including testing, cutover, and documentation.

Security Operations & Incident Response (~15%)

• Monitor, triage, and investigate security alerts across endpoints, identities, email, and cloud using SIEM/XDR tools (e.g., Microsoft Defender XDR, Microsoft Sentinel), including threat hunting informed by MITRE ATT&CK.
• Use AI‑assisted security tools (e.g., Microsoft Security Copilot) to accelerate investigation and response, validating outputs before acting on them.
• Support incident response from detection through containment, recovery, and post‑incident review, and help maintain incident response playbooks.
• Run vulnerability scans, prioritize findings by real‑world risk (e.g., CVSS, EPSS, and the CISA Known